1. 12 Jul, 2016 5 commits
    • John Johansen's avatar
    • John Johansen's avatar
      apparmor: exec should not be returning ENOENT when it denies · 9049a792
      John Johansen authored
      The current behavior is confusing as it causes exec failures to report
      the executable is missing instead of identifying that apparmor
      caused the failure.
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
      9049a792
    • John Johansen's avatar
      apparmor: fix uninitialized lsm_audit member · b6b1b81b
      John Johansen authored
      BugLink: http://bugs.launchpad.net/bugs/1268727
      
      The task field in the lsm_audit struct needs to be initialized if
      a change_hat fails, otherwise the following oops will occur
      
      BUG: unable to handle kernel paging request at 0000002fbead7d08
      IP: [<ffffffff8171153e>] _raw_spin_lock+0xe/0x50
      PGD 1e3f35067 PUD 0
      Oops: 0002 [#1] SMP
      Modules linked in: pppox crc_ccitt p8023 p8022 psnap llc ax25 btrfs raid6_pq xor xfs libcrc32c dm_multipath scsi_dh kvm_amd dcdbas kvm microcode amd64_edac_mod joydev edac_core psmouse edac_mce_amd serio_raw k10temp sp5100_tco i2c_piix4 ipmi_si ipmi_msghandler acpi_power_meter mac_hid lp parport hid_generic usbhid hid pata_acpi mpt2sas ahci raid_class pata_atiixp bnx2 libahci scsi_transport_sas [last unloaded: tipc]
      CPU: 2 PID: 699 Comm: changehat_twice Tainted: GF          O 3.13.0-7-generic #25-Ubuntu
      Hardware name: Dell Inc. PowerEdge R415/08WNM9, BIOS 1.8.6 12/06/2011
      task: ffff8802135c6000 ti: ffff880212986000 task.ti: ffff880212986000
      RIP: 0010:[<ffffffff8171153e>]  [<ffffffff8171153e>] _raw_spin_lock+0xe/0x50
      RSP: 0018:ffff880212987b68  EFLAGS: 00010006
      RAX: 0000000000020000 RBX: 0000002fbead7500 RCX: 0000000000000000
      RDX: 0000000000000292 RSI: ffff880212987ba8 RDI: 0000002fbead7d08
      RBP: ffff880212987b68 R08: 0000000000000246 R09: ffff880216e572a0
      R10: ffffffff815fd677 R11: ffffea0008469580 R12: ffffffff8130966f
      R13: ffff880212987ba8 R14: 0000002fbead7d08 R15: ffff8800d8c6b830
      FS:  00002b5e6c84e7c0(0000) GS:ffff880216e40000(0000) knlGS:0000000055731700
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000002fbead7d08 CR3: 000000021270f000 CR4: 00000000000006e0
      Stack:
       ffff880212987b98 ffffffff81075f17 ffffffff8130966f 0000000000000009
       0000000000000000 0000000000000000 ffff880212987bd0 ffffffff81075f7c
       0000000000000292 ffff880212987c08 ffff8800d8c6b800 0000000000000026
      Call Trace:
       [<ffffffff81075f17>] __lock_task_sighand+0x47/0x80
       [<ffffffff8130966f>] ? apparmor_cred_prepare+0x2f/0x50
       [<ffffffff81075f7c>] do_send_sig_info+0x2c/0x80
       [<ffffffff81075fee>] send_sig_info+0x1e/0x30
       [<ffffffff8130242d>] aa_audit+0x13d/0x190
       [<ffffffff8130c1dc>] aa_audit_file+0xbc/0x130
       [<ffffffff8130966f>] ? apparmor_cred_prepare+0x2f/0x50
       [<ffffffff81304cc2>] aa_change_hat+0x202/0x530
       [<ffffffff81308fc6>] aa_setprocattr_changehat+0x116/0x1d0
       [<ffffffff8130a11d>] apparmor_setprocattr+0x25d/0x300
       [<ffffffff812cee56>] security_setprocattr+0x16/0x20
       [<ffffffff8121fc87>] proc_pid_attr_write+0x107/0x130
       [<ffffffff811b7604>] vfs_write+0xb4/0x1f0
       [<ffffffff811b8039>] SyS_write+0x49/0xa0
       [<ffffffff8171a1bf>] tracesys+0xe1/0xe6
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
      b6b1b81b
    • John Johansen's avatar
      apparmor: fix replacement bug that adds new child to old parent · ec34fa24
      John Johansen authored
      When set atomic replacement is used and the parent is updated before the
      child, and the child did not exist in the old parent so there is no
      direct replacement then the new child is incorrectly added to the old
      parent. This results in the new parent not having the child(ren) that
      it should and the old parent when being destroyed asserting the
      following error.
      
      AppArmor: policy_destroy: internal error, policy '<profile/name>' still
      contains profiles
      Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      Acked-by: default avatarSeth Arnold <seth.arnold@canonical.com>
      ec34fa24
    • John Johansen's avatar
  2. 09 Jul, 2016 1 commit
  3. 08 Jul, 2016 1 commit
  4. 07 Jul, 2016 3 commits
  5. 30 Jun, 2016 8 commits
  6. 27 Jun, 2016 19 commits
  7. 25 Jun, 2016 3 commits